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Abstract 


Service Function Chaining (SFC) uses the Network Service Header (NSH) (RFC 8300) to steer and 
provide context metadata (MD) with each packet. Such metadata can be of various types, 
including MD Type 2, consisting of Variable-Length Context Headers. This document specifies 
several such Context Headers that can be used within a Service Function Path (SFP). 


Status of This Memo 


This is an Internet Standards Track document. 


This document is a product of the Internet Engineering Task Force (IETF). It represents the 
consensus of the IETF community. It has received public review and has been approved for 
publication by the Internet Engineering Steering Group (IESG). Further information on Internet 
Standards is available in Section 2 of RFC 7841. 


Information about the current status of this document, any errata, and howto provide feedback 
on it may be obtained at https://www.rfc-editor.org/info/rfc9263. 


Copyright Notice 


Copyright (c) 2022 IETF Trust and the persons identified as the document authors. All rights 
reserved. 


This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF 
Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this 
document. Please review these documents carefully, as they describe your rights and restrictions 
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with respect to this document. Code Components extracted from this document must include 
Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are 
provided without warranty as described in the Revised BSD License. 
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1. Introduction 


The Network Service Header (NSH) [RFC8300] is the Service Function Chaining (SFC) 
encapsulation that supports the SFC architecture [RFC7665]. As such, the NSH provides the 
following key elements: 


1. Service Function Path (SFP) identification 
2. indication of location within an SFP 
3. optional, per-packet metadata (fixed-length or variable-length) 


[RFC8300] further defines two metadata formats (MD Types): 1 and 2. MD Type 1 defines the 
fixed-length, 16-octet metadata, whereas MD Type 2 defines a variable-length context format for 
metadata. This document defines several common metadata Context Headers for use within NSH 
MD Type 2. These supplement the Subscriber Identifier and Performance Policy MD Type 2 
metadata Context Headers specified in [RFC8979]. 


This document does not address metadata usage, updating/chaining of metadata, or other SFP 
functions. Those topics are described in [RFC8300]. 


2. Conventions Used in This Document 


2.1. Terminology 


This document uses the terminology defined in the SFC architecture [RFC7665] and the NSH 
[RFC8300]. 


2.2. Requirements Language 


The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", 
"RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be 
interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all 
capitals, as shown here. 
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3. NSH MD Type 2 Format 


An NSH is composed of a 4-octet Base Header, a 4-octet Service Path Header, and optional 
Context Headers. The Base Header identifies the MD Type in use: 


7) 1 2 3 
OU A e 2 og 7 ee OY 2s wo Ge 7 ee) Wwe Abs 7 te) Ge) 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
|Ver|O|U| AGE | Length |U|U|U|U|MD Type| Next Protocol | 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
Figure 1: NSH Base Header 


Please refer to the NSH [RFC8300] for a detailed header description. 


When the Base Header specifies MD Type = 0x2, zero or more Variable-Length Context Headers 
MAY be added, immediately following the Service Path Header. Figure 2 below depicts the format 
of the Context Header as defined in Section 2.5.1 of [RFC8300]. 


2) 1 2 3 
I1TA2ZS45 G7 sO 12st ogy to | 2s Ae Gy Ge) G4 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
| Metadata Class | Type lU] Length 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
| Variable-Length Metadata 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
Figure 2: NSH Variable-Length Context Headers 


+—+— +4 


4. NSH MD Type 2 Context Headers 


[RFC8300] specifies Metadata Class 0x0000 as IETF Base NSH MD Class. In this document, 
metadata types are defined for the IETF Base NSH MD Class. The Context Headers specified in the 
subsections below are as follows: 


1. Forwarding Context 

2. Tenant ID 

3. Ingress Network Node Information 
4. Ingress Node Source Interface 

5. Flow ID 

6. Source and/or Destination Groups 
7. Policy ID 
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4.1. Forwarding Context 


This metadata context carries a network forwarding context, used for segregation and 
forwarding scope. Forwarding context can take several forms depending on the network 
environment, for example, Virtual eXtensible Local Area Network (VXLAN) / Generic Protocol 
Extension for VXLAN (VXLAN-GPE) Virtual Network Identifier (VNID), VPN Routing and 
Forwarding (VRF) identification, or VLAN. 


o 1 2 3 
Cee 2er SrA ee 6s e/a SOM Oak eZ Sarda Om Om/ 269 O sO alte mesos Ome Om Om Oma 


+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
| Metadata Class = @x@000 | Type = 0x04 |U| Length = 4 | 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
|CT=0x0 | Reserved | VLAN ID | 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
Figure 3: VLAN Forwarding Context 
(3 1 2 3 


GEA SRA E A E E I O E E A e E E E T O A Om e] 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
| Metadata Class @xe000 | Type = 0x04 |U| Length = 4 | 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
|CT=@x1 |Resv | Service VLAN ID | Customer VLAN ID 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 

Figure 4: QinQ Forwarding Context 


FOSE 


(3 1 2 3 
Onli 2e 3 Ae 5G a / se Com On Minas An 5 mOne/e CO Onlde2 esr Ae 5G e/seG E 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
| Metadata Class = @x@000 | Type = 0x04 |U| Length 4 | 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
|CT=0x2 | Reserved | MPLS VPN Label 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
Figure 5: MPLS VPN Forwarding Context 


alll Sn 


+ 


2) 1 2 3 
OI 2= 3RAe 5 G8 On O lie 2a Sm Al 56.0788 9m Gale S456 eS G el 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
| Metadata Class = 0x0000 | Type = 0x04 |U| Length 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
|CT=@x3 | Resv | Virtual Network Identifier 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
Figure 6: VNI Forwarding Context 


see ae 


+ 
| 
-+ 
| 
+ 


Wei, et al. Standards Track Page 5 


RFC 9263 NSH MD2 Context Headers August 2022 


Q 1 2 3 
A er a a y e a A S S a A e N a A e e S A e e a 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
| Metadata Class = 0x0000 | Type @x@4 |U| Length 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
[CT=0x4 | Reserved 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
| Session ID 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 


Figure 7: Session ID Forwarding Context 


+ Uh E 
+ I + 
œ 


+—+—4+—+4 


The fields are described as follows: 


Context Type (CT): This 4-bit field that defines the interpretation of the Forwarding Context field. 
Please see the IANA considerations in Section 6.2. This document defines these CT values: 


0x0: 12-bit VLAN identifier [IEEE.802.1Q_ 2018]. See Figure 3. 


0x1: 24-bit double tagging identifiers. A service VLAN tag followed by a customer VLAN tag 
[IEEE.802.1Q_2018]. The two VLAN IDs are concatenated and appear in the same order 
that they appeared in the payload. See Figure 4. 


0x2: 20-bit MPLS VPN label [RFC3032] [RFC4364]. See Figure 5. 
0x3: 24-bit virtual network identifier (VNI) [RFC8926]. See Figure 6. 
0x4: 32-bit Session ID [RFC3931]. This is called Key in GRE [RFC2890]. See Figure 7. 


Reserved (Resv): These bits in the context fields MUST be sent as zero and ignored on receipt. 


4.2. Tenant ID 


Tenant identification is often used for segregation within a multi-tenant environment. 
Orchestration system-generated Tenant IDs are an example of such data. This Context Header 
carries the value of the Tenant ID. Virtual Tenant Network (VIN) [OpenDaylight-VTN] is an 
application that provides multi-tenant virtual networks on a Software-Defined Networking (SDN) 
controller. 


7) 1 2 3 
Ga A e rS E A e e yee ae 7 a e Bae e S 7 3 S a 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
| Metadata Class = @x@000 | Type @x@5 |U] Length 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
~ Tenant ID 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 


Figure 8: Tenant ID List 


+i + 
+? +—+ 


The fields are described as follows: 
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Length: Indicates the length of the Tenant ID in octets (see Section 2.5.1 of [RFC8300]). 


TenantID: Represents an opaque value pointing to orchestration system-generated Tenant ID. 
The structure and semantics of this field are specific to the operator's deployment across its 
operational domain and are specified and assigned by an orchestration function. The 
specifics of that orchestration-based assignment are outside the scope of this document. 


4.3. Ingress Network Node Information 


This Context Header carries a Node ID of the network node at which the packet entered the SFC- 
enabled domain. This node will necessarily be a classifier [RFC7665]. In cases where the Service 
Path Identifier (SPI) identifies the ingress node, this Context Header is superfluous. 


2) 1 2 3 
2128450 7 oO Tee’ Oy tye 1 Ae oy te) C7 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
| Metadata Class = 0x0000 | Type Əxð6 |U] Length 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
~ Node ID 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
Figure 9: Ingress Network Node ID 


+i + 
+? +—+ 


The fields are described as follows: 


Length: Indicates the length of the Node ID in octets (see Section 2.5.1 of [RFC8300]). 


Node ID: Represents an opaque value of the ingress network Node ID. The structure and 
semantics of this field are deployment specific. For example, Node ID may be a 4-octet IPv4 
address Node ID, a 16-octet IPv6 address Node ID, a 6-octet MAC address, an 8-octet MAC 
address (64-bit Extended Unique Identifier (EUI-64)), etc. 


4.4. Ingress Network Source Interface 


This context identifies the ingress interface of the ingress network node. The 12vlan (135), l3ipvlan 
(136), ipForward (142), and mpls (166) in [IANAifType] are examples of source interfaces. 


2) 1 2 3 

0 1 2.374 55677 8°90 192 7394°5°6 7 896 12°53 45°56 78 96 1 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
| Metadata Class = @x@000 | Type 0x07 |U] Length 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
~ Source Interface 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 


Figure 10: Ingress Network Source Interface 


+ + 
+? +—+ 


The fields are described as follows: 
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Length: Indicates the length of the Source Interface in octets (see Section 2.5.1 of [RFC8300]). 


Source Interface: Represents an opaque value of the identifier of the ingress interface of the 
ingress network node. 


4.5. Flow ID 


Flow ID provides a field in NSH MD Type 2 to label packets belonging to the same flow. For 
example, [RFC8200] defines IPv6 Flow Label as Flow ID. Another example of Flow ID is how 
[RFC6790] defines an entropy label that is generated based on flow information in the MPLS 
network. Absence of this field or a value of zero denotes that packets have not been labeled witha 
Flow ID. 


2) 1 2 3 
2128456 7 Tee’ Oy tye) Ae a Oy te) 7 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
| Metadata Class = 0x0000 | Type = @x@8 |U| Length = 4 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
|CT=0x0 | Reserved | IPv6 Flow ID 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
Figure 11: IPv6 Flow ID 


I 
+ 
1 
+ 
I 
+ 
L] 
+ 
I 
+ 
I 
+ 
I 
+— +—+4+ 


Q 1 2 3 
O16 233,745°5565 7 8 978 1203 455) 67 859581 8273545556) 7 89°61 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
| Metadata Class = @x@000 | Type = @x@8 |U| Length = 4 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
|CT=0x1 | Reserved | MPLS entropy label 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 


Figure 12: MPLS Entropy Label 


+—+—+ 


The fields are described as follows: 


Length: Indicates the length of the Flow ID in octets (see Section 2.5.1 of [RFC8300]). For example, 
the IPv6 Flow Label in [RFC8200] is 20 bits long. An entropy labelin the MPLS network in 
[RFC6790] is also 20 bits long. 


Context Type (CT): This 4-bit field that defines the interpretation of the Flow ID field. Please see 
the IANA considerations in Section 6.3. This document defines these CT values: 


0x0: 20-bit IPv6 Flow Label in [RFC8200]. See Figure 11. 
0x1: 20-bit entropy label in the MPLS network in [RFC6790]. See Figure 12. 


Reserved: These bits in the context fields MUST be sent as zero and ignored on receipt. 
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4.6. Source and/or Destination Groups 


Intent-based systems can use this data to express the logical grouping of source and/or 
destination objects. [OpenStack] and [OpenDaylight] provide examples of such a system. Each is 
expressed as a 32-bit opaque object. 


Q 1 2 3 
JULZSASGE TRY TAA aay ey Op A e we oh 7 ee oO 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
| Metadata Class = 0x0000 | Type @x@9 |U| Length=8 | 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
| Source Group | 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
| Destination Group | 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
Figure 13: Source/Destination Groups 


+ E 


If there is no group information specified for the Source Group or Destination Group field, the 
field MUST be sent as zero and ignored on receipt. 


4.7. Policy ID 


Traffic handling policies are often referred to by a system-generated identifier, which is then used 
by the devices to look up the policy's content locally. For example, this identifier could be an index 
to an array, a lookup key, or a database ID. The identifier allows enforcement agents or services to 
look up the content of their part of the policy. 


o 1 2 3 
G A e A S E T a e e A e 5 E A e S a A e AS E T A S eT] 


+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
| Metadata Class = 0x0000 | Type = @x@A |U] Length | 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
~ Policy ID ~ 


+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
Figure 14: Policy ID 


The fields are described as follows: 


Length: Indicates the length of the Policy ID in octets (see Section 2.5.1 of [RFC8300]). 


Policy ID: Represents an opaque value of the Policy ID. 


This Policy ID is a general Policy ID, essentially a key to allow Service Functions (SFs) to know 
which policies to apply to packets. Those policies generally will not have much to do with 
performance but rather with what specific treatment to apply. It may, for example, select a URL 
filter data set for a URL filter or select a video transcoding policy in a transcoding SF. The 
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Performance Policy ID in [RFC8979] is described there as having very specific use and, for 
example, says that fully controlled SFPs would not use it. The Policy ID in this document is for 
cases not covered by [RFC8979]. 


5. Security Considerations 


A misbehaving node from within the SFC-enabled domain may alter the content of the Context 
Headers, which may lead to service disruption. Such an attack is not unique to the Context 
Headers defined in this document. Measures discussed in Section 8 of [RFC8300] describes the 
general security considerations for protecting the NSH. [RFC9145] specifies methods of protecting 
the integrity of the NSH metadata. If the NSH includes the Message Authentication Code (MAC) 
and Encrypted Metadata Context Header [RFC9145], the authentication of the packet MUST be 
verified before using any data. If the verification fails, the receiver MUST stop processing the 
Variable-Length Context Headers and notify an operator. 


The security and privacy considerations for the 7 types of Context Headers specified above are 
discussed below. Since NSH-ignorant SFs will never see the NSH, then even if they are malign, they 
cannot compromise security or privacy based on the NSH or any of these Context Headers; 
however, they could cause compromise based on the rest of the packet. To the extent that any of 
these headers are included when they would be unneeded or have no effect, they provide a covert 
channel for the entity adding the Context Header to communicate a limited amount of arbitrary 
information to downstream entities within the SFC-enabled domain. 


5.1. Forwarding Context 


All of the Forwarding Context variants specified in this document (those with CT values between 0 
and 4) merely repeat a field that is available in the packet encapsulated by the NSH. These 
variants repeat that field in the NSH for convenience. Thus, there are no special security or 
privacy considerations in these cases. Any future new values of CT for the Forwarding Context 
must specify the security and privacy considerations for those extensions. 


5.2. Tenant ID 


The Tenant ID indicates the tenant to which traffic belongs and might be used to tie together and 
correlate packets for a tenant that some monitoring function could not otherwise group, 
especially if other possible identifiers were being randomized. As such, it may reduce security by 
facilitating traffic analysis but only within the SFC-enabled domain where this Context Header is 
present in packets. 
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5.3. Ingress Network Node Information 


The SFC-enabled domain manager normally operates the initial ingress/classifier node and is 
thus potentially aware of the information provided by this Context Header. Furthermore, in 
many cases, the SPI that will be present in the NSH identifies or closely constrains the ingress 
node. Also, in most cases, it is anticipated that many entities will be sending packets into an SFC- 
enabled domain through the same ingress node. Thus, under most circumstances, this Context 
Header is expected to weaken security and privacy to only a minor extent and only within the 
SFC-enabled domain. 


5.4. Ingress Node Source Interface 


This Context Header is likely to be meaningless unless the Ingress Network Node Information 
Context Header is also present. When that node information header is present, this source 
interface header provides a more fine-grained view of the source by identifying not just the initial 
ingress/classifier node but also the port of that node on which the data arrived. Thus, it is more 
likely to identify a specific source entity or at least to more tightly constrain the set of possible 
source entities than just the node information header. As a result, inclusion of this Context 
Header with the node information Context Header is potentially a greater threat to security and 
privacy than the node information header alone, but this threat is still constrained to the SFC- 
enabled domain. 


5.5. Flow ID 


The variations of this Context Header specified in this document simply repeat fields already 
available in the packet and thus have no special security or privacy considerations. Any future 
new values of CT for the Flow ID must specify the security and privacy considerations for those 
extensions. 


5.6. Source and/or Destination Groups 


This Context Header provides additional information that might help identify the source and/or 
destination of packets. Depending on the granularity of the groups, it could either (1) distinguish 
packets as part of flows from and/or to objects where those flows could not otherwise be easily 
distin guished but appear to be part of one or fewer flows or (2) group packet flows that are from 
and/or to an object where those flows could not otherwise be easily grouped for analysis or 
another purpose. Thus, the presence of this Context Header with non-zero source and/or 
destination groups can, within the SFC-enabled domain, erode security and privacy to an extent 
that depends on the details of the grouping. 


5.7. Policy ID 


This Context Header carries an identifier that nodes in the SFC-enabled domain can use to look 
up policy to potentially influence their actions with regard to the packet carrying this header. If 
there are no such decisions regarding their actions, then the header should not be included. If 
there are such decisions, the information on which they are to be based needs to be included 
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somewhere in the packet. There is no reason for inclusion in this Context Header to have any 
security or privacy considerations that would not apply to any other plaintext way of including 
such information. It may provide additional information to help identify a flow of data for 
analysis. 


6. IANA Considerations 


6.1. MD Type 2 Context Types 


IANA has assigned the following types (Table 1) from the "NSH IETF-Assigned Optional Variable- 
Length Metadata Types" registry available at [[ANA-NSH-MD2]. 


Value Description Reference 
0x04 Forwarding Context RFC 9263 
0x05 Tenant ID RFC 9263 
0x06 Ingress Network Node ID RFC 9263 
0x07 Ingress Network Interface RFC 9263 
0x08 Flow ID RFC 9263 


0x09 Source and/or Destination Groups RFC 9263 


Ox0A Policy ID RFC 9263 
Table 1: Type Values 


6.2. Forwarding Context Types 


IANA has created a new subregistry for "Forwarding Context Types" at [[ANA-NSH-MD2] as 
follows. 


The registration policy is IETF Review. 


Value Description Reference 
0x0 12-bit VLAN identifier RFC 9263 
0x1 24-bit double tagging identifiers RFC 9263 
0x2 20-bit MPLS VPN label RFC 9263 
0x3 24-bit virtual network identifier (VNI) RFC 9263 
0x4 32-bit Session ID RFC 9263 
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Value Description Reference 
0x5-0xE Unassigned 
OxF Reserved RFC 9263 


Table 2: Forwarding Context Types 


6.3. Flow ID Context Types 
IANA has created a new subregistry for "Flow ID Context Types" at [[ANA-NSH-MD2] as follows. 


The registration policy is IETF Review. 


Value Description Reference 
0x0 20-bit IPv6 Flow Label RFC 9263 
0x1 20-bit entropy labelin the MPLS network RFC 9263 
0x2-0xE Unassigned 

OxF Reserved RFC 9263 


Table 3: Flow ID Context Types 
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